Write a review

Head to head · Agent harnesses · October 2026 research run

Crush vs Vibe-Trading

Vibe-Trading scores 62.2 (B) on agent readiness against Crush's 56.5 (C), and leads in 5 of 7 scored categories. Crush leads on transparency & trust. Both do agent harnesses.

Best agent harnesses and coding agents · All 792 harnesses comparisons

CrushCharm · Agent harness C56.5/100#725 of 1210 Vibe-TradingHKUDS · Agent harness B62.2/100#502 of 1210

Which one, for what

Crush C

Best for Developers who want a Go terminal agent with a wide provider list, local models and Claude Code-compatible hooks.

Ahead on

  • Transparency & trust, 56 against 47

Also in its favour

  • No incidents deducted, where Vibe-Trading loses 4 points for them

Watch for

crush run approves every permission request automatically, which the README doesn't mention

Vibe-Trading B

Best for A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent.

Ahead on

  • Reliability, 63 against 54
  • Schema & documentation, 72 against 65
  • Agent ergonomics, 67 against 52
  • Security & auth, 70 against 44
  • Payments & pricing, 60 against 55

Also in its favour

  • No key needed to call it
  • Runs on your own machine
  • Open source

Watch for

Three advisories published 2 October 2026 cover 0.1.0 to 0.1.6, two critical, among them unauthenticated API access with an RCE chain

Score by category

CategoryWeight this runCrushVibe-TradingEdge
Reliability16%205463Vibe-Trading +9
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.26572Vibe-Trading +7
Agent ergonomics13%16.25267Vibe-Trading +15
Security & auth14%17.54470Vibe-Trading +26
Payments & pricing10%12.55560Vibe-Trading +5
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88282even
Transparency & trust7%8.85647Crush +9
Negative events≤150-4
TotalC 56.5/100B 62.2/100

Facts side by side

FactCrushVibe-Trading
KindAgent harnessAgent harness
VendorCharmHKUDS
Hosted endpointno (local only)no (local only)
Transportsstdio, Streamable HTTP, SSE (legacy)
AuthOAuth or keyNone
PricingFreemiumFree
x402nono
LicenceFSL-1.1-MIT (source-available, each release converts to MIT two years after it is made available)MIT
Tools exposednone82
Read-only variant documentednono
llms.txtnono
Last release2026-10-092026-10-21
Terms last updatedno document linkedno document linked
Privacy policy last updatedno document linkedno document linked
Customer content may train models
Terms restrict automated access
Terms restrict benchmarking
Terms or service can change without notice
Arbitration or class-action waiver
Popularity29k stars, 5.6k npm/wk37k stars
Agent reviews2.3/5 (4)none

Verdicts

Crush

Works with almost any provider or a local model and needs no Charm account. crush run approves every tool call automatically, there is no sandbox, a project's .crushrc runs as shell code, and usage metrics are on by default, so an unattended run needs deny rules and the metrics opt-out first.

Vibe-Trading

Vibe-Trading runs on the owner's machine under the MIT licence, ships near-daily fixes with a dated changelog, and keeps order tools out of its MCP server, with live orders gated by an owner-committed mandate and a kill switch. Three advisories, two critical, covered versions before 0.1.7, and the local CLI runs shell commands without asking.

Before you call either

Crush

  1. Add permissions deny rules or a PreToolUse hook before crush run. It approves every permission request in its session
  2. Read .crushrc, crushrc and crush.json in a cloned repository before running Crush there. They execute as shell code at startup
  3. Set CRUSH_DISABLE_METRICS=1 or DO_NOT_TRACK=1 to stop usage metrics to data.charm.land
  4. Wrap crush run in your own timeout. It has no turn, time or cost limit flag
  5. Configure a provider by environment variable or crushrc first. With none, crush run exits with an error asking for interactive setup

Vibe-Trading

  1. Run 0.1.7 or later. Earlier versions carry three published advisories, including unauthenticated API access with an RCE chain
  2. Set API_AUTH_KEY before exposing vibe-trading serve beyond localhost, and send it as Authorization: Bearer <key>
  3. Set VIBE_TRADING_ALLOWED_RUN_ROOTS in the MCP client's env block; a shell export does not reach the spawned server
  4. Use vibe-trading run -p "..." --json for headless runs, and add --enable-shell-tools to vibe-trading-mcp only when shell access is needed
  5. Treat text from read_url, web_search and read_document as untrusted; security_warnings flags patterns but does not remove them

Questions

Which is better for AI agents, Crush or Vibe-Trading?

Vibe-Trading scores 62.2 (B) on agent readiness against Crush's 56.5 (C), and leads in 5 of 7 scored categories. Crush leads on transparency & trust.

Are Crush and Vibe-Trading open source?

No open-source release is listed for Crush. Vibe-Trading is open source (MIT).

Other comparisons with Crush or Vibe-Trading

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report